Linux kernel (drivers/nvme/host): On the NVMe/RDMA initiator, an async-event command can be submitted against an admin

CVSS 9.8CVE-2022-48788Kernel, userspace & hypervisorcurated

Impact

On the NVMe/RDMA initiator, an async-event command can be submitted against an admin queue that error recovery is concurrently destroying, giving a use-after-free in the host kernel. The node corrupts freed transport state and typically panics, dropping every tenant workload on it.

Who can reach it

Initiator-side, but the trigger is remote: error recovery only runs when the RDMA connection breaks, and the target (or a peer that can disrupt the fabric path) decides when that happens. If your compute nodes mount NVMe/RDMA volumes from targets a tenant controls or can influence, that peer can time connection drops against the controller's own AER traffic. Requires nvme-rdma in use; no local privilege needed on the initiator.

What to do

No fixed version is listed on this record - boot a kernel carrying the linked stable commits. Interim: keep NVMe/RDMA initiator traffic on a fabric segment tenants cannot disturb, and drain nodes that show repeated transport error recovery.

References

https://git.kernel.org/stable/c/5593f72d1922403c11749532e3a0aa4cf61414e9 https://git.kernel.org/stable/c/d411b2a5da68b8a130c23097014434ac140a2ace https://nvd.nist.gov/vuln/detail/CVE-2022-48788

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.